Privacy Notice

Version 1.1 · Effective 20 August 2026 · Supersedes version 1.0 of 1 August 2026

This notice explains what personal data the Xπ Space Domain Awareness console collects, why, and what you can do about it. It is written to be checked against the software rather than to sound reassuring: every category below corresponds to something the platform actually stores.

The version number matters. When you accept this notice, the account record keeps both the timestamp and the version you were shown. If the text changes materially the version is raised — so we can always say exactly what each account holder agreed to.

This is version 1.1. It replaces version 1.0, effective 1 August 2026. Accounts created before this date consented to that earlier text, which is retained and available on request.

1. Who is responsible

The data controller is xPi Artificial Intelligence Developing Services (trading as Xπ), a sole establishment licensed in Dubai, United Arab Emirates under Professional Licence No. 1637911, operating the platform at www.xpi.ae.

For anything in this notice, including a request to exercise your rights, write to connect@xpi.ae.

2. The law we work to

Processing is carried out in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where an account is created by a person for themselves, the lawful basis is that person's consent, recorded as described above. Where an organisation's administrator creates an account, the basis is the legitimate interest of operating a subscribed service, and security records are kept on the basis of our obligation to protect the platform.

3. What is collected

Category	Fields	Why
Account	Username, password (stored only as a PBKDF2-HMAC-SHA256 hash with a per-user salt, 200,000 iterations — never in readable form), email address, role	To create the account and decide what it may see
Profile, if you register yourself	Full name, phone number, country, organisation	Supplied on the registration form so an operator can tell accounts apart and reach you about the service
Consent	Date and time of acceptance, version of this notice	The lawful basis for holding the account
Sign-in and sessions	Last sign-in time, failed-attempt count, and per-session records: IP address, browser user-agent string, creation and last-seen times, revocation state	To keep you signed in, to show you your own active sessions so you can end them, and to lock an account under password guessing
Two-factor authentication, if you enrol	A TOTP seed, the enrolment time, the last accepted time-step, and recovery codes stored only as hashes	To verify your second factor and to stop a code being replayed. A recovery code is a password equivalent, so the database holds hashes and never the codes themselves
Linked sign-in providers	Provider name, the provider's subject identifier, the email address seen at the moment of linking, link and last-use times	So a later sign-in with UAE PASS, Google or Microsoft resolves to your account
Administrative audit trail	Who did what to which account, and when	Accountability for privileged actions. Application logs carry only a masked address such as `a***@example.com`; the full value stays in the access-controlled audit table

Space-object data — orbits, conjunctions, sensor geometry — is not personal data and is not covered by this notice.

4. UAE PASS

If you sign in with UAE PASS, the platform requests exactly four attributes: userType, uuid, email and fullnameEN.

The Emirates ID number is not requested and never stored.
The uuid is the key your account is matched on. The email address is not used to find or link an account.
The access token issued during sign-in is used once to read those attributes and is then discarded. It is never stored.
UAE PASS consent is given in the UAE PASS mobile application. Xπ neither presents nor records a consent screen of its own for UAE PASS attributes.
No attribute obtained from UAE PASS is disclosed to any client organisation, sold, shared with third parties, or used for marketing or profiling.

5. Cookies and browser storage

There is no analytics, advertising, tracking pixel or third-party cookie anywhere on this platform.

Strictly necessary. One short-lived cookie (sda-oauth-state) protects a social or UAE PASS sign-in against request forgery while the exchange is in flight. Your session token is held in the browser's local storage so you stay signed in. Neither can be declined without breaking sign-in, and the notice you are shown says so.
Optional. Interface preferences — the panels you opened, the filters you last used. Declining these is a real choice: preferences still work for the session, they are simply not remembered. Your answer is kept under the key sda-cookie-choice, and every optional write in the application checks it first.

You can change your mind at any time by clearing site data for this domain, which removes the stored answer and brings the notice back.

6. Who else sees the data

Personal data is not sold and is not shared for anyone else's marketing. It reaches a third party only in these cases:

Email delivery. Verification, password-reset and contact messages are sent through the configured SMTP provider, which necessarily handles the recipient address and the message.
Identity providers. UAE PASS, Google or Microsoft, when you choose to sign in with one — and only the exchange needed to do so.
AI assistance, where a deployment enables it. The assistant and the written briefs send the text of your question and the operational data it concerns to the configured model provider (Anthropic or OpenAI). Do not paste personal data into the assistant that you would not send to that provider. A deployment with no model key configured has the feature disabled outright.
Map tiles. Your browser fetches basemap imagery directly from CARTO, which therefore sees your IP address as it would for any image on the web. No account data is sent with those requests.
Legal obligation. Where a competent UAE authority requires disclosure under applicable law.

There are no other recipients. The platform's own content-security policy permits exactly the origins listed here and nothing else, which is what makes that statement checkable rather than a promise.

7. Where it is processed

The platform runs on infrastructure under xPi's sole control, and the sign-in exchange with UAE PASS stays within that boundary. Where any processing takes place outside the United Arab Emirates, it is carried out under the safeguards the PDPL requires for cross-border transfers. The current hosting region is stated on request to any subscriber or assessor who asks.

8. How long it is kept

Account and profile: for as long as the account exists, and then deleted on request.
Sessions: until the token expires or you revoke the session, whichever comes first.
Audit trail: retained for accountability, and not used for any other purpose.
Application logs: rotated and capped, and they carry masked identifiers rather than full addresses.

9. Your rights

Under the PDPL you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how it is processed, or provide it in a portable form. Where processing rests on consent, you may withdraw that consent — which for a self-registered account means asking us to close it.

Much of this is available without writing to anyone: your profile is editable in the console at Account, active sessions can be ended there, and a password or second factor can be changed at Account → Security. For anything else, or to have an account deleted, write to connect@xpi.ae. We answer within 30 days. If you are not satisfied, see Complaints below.

10. How it is protected

Passwords are salted and hashed; the plaintext is never written anywhere.
Two-factor authentication is available to every account and can be required of privileged ones.
Access is decided by the role on your account, and hiding a page is never mistaken for securing it — each API route enforces its own role.
Sign-in endpoints are rate-limited, and repeated failures freeze password login until an emailed reset is completed.
Traffic is served over TLS with HSTS, a strict content-security policy, and no third-party scripts.

No system is perfect. If you believe you have found a vulnerability, please write to connect@xpi.ae before disclosing it publicly.

11. Automated decision-making

We do not make decisions that produce legal effects for you, or similarly significantly affect you, by purely automated means.

This is worth stating plainly for a platform of this kind, because it generates a great many automated numbers. Risk scores, collision probabilities, screening thresholds, alert bands and AI-written briefs are all decision support for a human operator — they exist to inform a decision, never to take one. Nothing the console proposes is executed without a person confirming it, and no account is created, restricted, suspended or refused by an automated process. Your role is set by an administrator, not inferred.

12. Children

The console is a professional tool for institutional operators and analysts. It is not directed at children and accounts are not knowingly created for them.

13. On-premise installations

Where an entity runs Xπ on its own premises, that installation is air-gapped and separate. It does not use UAE PASS, its authentication is chosen and operated by that entity, and xPi holds neither its login information nor its database. This notice covers the shared service at www.xpi.ae only; for an on-premise installation, the operating entity is the controller and its own notice applies.

14. Complaints

If you are unhappy with how we have handled your personal data or a request about it, tell us first at connect@xpi.ae — most things are quicker to fix directly. You do not have to come to us first, and nothing here limits your right to complain to the UAE Data Office, the supervisory authority under the PDPL, at any time.

15. Changes

We will update this notice when the service, the third parties we rely on, or the law changes — in particular once the PDPL Executive Regulations are issued.

The version and effective date are always at the top of this page. Where a change materially affects your rights or how your data is used, we will email account holders at least 14 days before it takes effect, and the version number is raised. Minor corrections are made in place. Previous versions are retained and available on request.